Security Requirements

SwiftBizness uses role-aware routes, protected server handlers, Supabase data separation, audit logs, request rate limiting, bot and abuse checks, staff account validation, work-hour restrictions, API key hashing, scoped API access, and security headers.

Financial and high-impact actions such as payment approval, referral approval, payout recording, rejected referral override, and duplicate merge review require authorized business access.

Public APIs are designed for ingestion and draft creation. External websites should not be able to approve payments, approve referrals, issue refunds, delete customers, or modify commissions.

Owners should use strong passwords, private email accounts, trusted devices, and prompt password resets if compromise is suspected.

Owners and managers should assign least-privilege staff permissions, limit branch access, configure work hours, reset staff passwords when needed, and remove staff access quickly when authorization ends.

Staff must not share passwords or use another person's account. Every staff action should remain traceable to the person who performed it.